Log In Get Started
Free tool

DNS records of a domain

Half the trouble with a domain is visible in its records: mail does not flow without MX, letters land in spam without SPF and DMARC, the site shows someone else’s page because the address points at old hosting. Enter a domain, we show everything DNS answers about it and point out what is missing.

The request goes from your browser straight to a resolver, bypassing us.

Ready to check

The records are asked of a public resolver over DNS-over-HTTPS straight from your browser. Our servers take no part in it.

What is what

RecordWhat it does
A and AAAAthe addresses the site opens at: IPv4 and IPv6
CNAMEan alias: the domain points at another domain and takes its address
MXwhere to deliver mail. No MX means no mail on the domain
TXTservice lines, among them SPF, who is allowed to send mail in your name
DMARCwhat to do with letters that fail the checks. Lives in _dmarc.domain
NSname servers: who answers for this domain at all
CAAwhich certificate authorities may issue certificates for the domain

Nearby: who resolves names for you, whether a site opens from other countries and whose IP address this is.

Records fine but the site will not open?

Then it is not the domain but the road to it: blocking, a filter, or a fault at your provider. 404 VPN goes around that part.

How it works →

FAQ

guest@404vpn:~$ cat dns-records-faq.md
[01] $ How is this different from dig or nslookup? ▸
> In essence, not at all, these are the same queries, only from a browser and with human labels. The difference is convenience: you do not have to remember the syntax and the record types, and we ask for SPF and DMARC ourselves even though they live in different places, the first in the domain’s own TXT, the second in the TXT of the _dmarc subdomain.
[02] $ Why do you see a record while the site does not open in my browser? ▸
> Because we ask a public resolver and your computer asks its own. There can be a difference between them: fresh changes spread around the world in anything from minutes to a day, and a provider’s DNS sometimes holds an old answer longer than it should. If the records here are right and it still does not work for you, wait or change your resolver.
[03] $ What does "DNSSEC: signed" mean? ▸
> That this domain’s answers are cryptographically signed and the resolver verified the signature. It protects against an answer being substituted on the way: slipping you a foreign address instead of the real one becomes much harder. The absence of a signature is not a fault, most domains do not use it, but with it things are safer.
[04] $ No MX, is that an error? ▸
> Only if mail is supposed to work on this domain. For a domain that holds nothing but a website, having no MX is normal. But if you send letters from an address on this domain, then without MX, SPF and DMARC they will regularly go to spam, and that is worth fixing.
[05] $ Can you see which domains I check? ▸
> No. The request goes from your browser straight to a public resolver over DNS-over-HTTPS, it does not pass through our servers. We know neither the domain nor the answer.